Impacket smbexec

smbexec.py <domain>/<user>:'<pass>'@<target>

Executes commands on a remote Windows host by creating a temporary service via SMB (Service Control Manager) and returning output over a named pipe.

When you have administrative credentials and need remote execution from Linux with interactive output. Unlike wmiexec, it works even if WMI is blocked, as long as SMB (445) is open.

If the host has mandatory SMB signing or the EDR monitors service creation (7045/4697): smbexec leaves a temporary service during execution. For stealthy operations, prefer wmiexec (no services).